CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Tenda AC1206 router with firmware version v15.03.06.23, multiple stack overflows exist in the fromGstDhcpSetSer function via the username and password parameters. These vulnerabilities allow an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.
Buffer overflow vulnerability in the strcpy function in /goform/formConfigDnsFilterGlobal on UTT HiPER 2610G up to version 3.0.0-171107. Manipulating the GroupName argument can lead to buffer overflow.
A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to bypass certificate validation in VPN site-to-site connections that use certificate-based authentication.
A vulnerability in `cordova-plugin-inappbrowser` for iOS allows any web content loaded in the InAppBrowser to fire any pending Cordova callback in the host app. An attacker can post a message with an `id` field containing a guessable callback identifier, enabling spoofing of plugin results such as Camera, Contacts, File, or Geolocation.
A stack-based buffer overflow vulnerability has been detected in Tenda CX12L version 16.03.53.12 in the setSchedWifi function of the /goform/openSchedWifi file. Manipulation of the schedStartTime/schedEndTime arguments leads to buffer overflow. The attack can be launched remotely and the exploit is public.
This vulnerability in Bagisto is due to improper input validation in the ImageCacheController component. An unauthenticated remote attacker can exploit it by sending crafted path traversal sequences via the filename parameter to access arbitrary files outside the intended directory.
A stack-based buffer overflow vulnerability has been found in Tenda CX12L version 16.03.53.12 in the form_fast_setting_wifi_set function of the /goform/fast_setting_wifi_set file. Manipulation of the ssid argument leads to buffer overflow. The attack can be launched remotely and the exploit is public.
A security flaw in SourceCodester Hospitals Patient Records Management System 1.0 allows SQL injection in the file /classes/Master.php?f=save_patient via the ID argument. The attack can be launched remotely and the exploit has been publicly released.
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities. A malicious actor with privileges to create policies, views or text-widgets may inject scripts to perform administrative actions.
VMware Cloud Foundation Operations has multiple stored XSS vulnerabilities. A user with privileges to create policies, views, or text widgets can inject scripts to perform administrative actions.
VMware Cloud Foundation Operations has multiple stored cross-site scripting vulnerabilities. An attacker with privileges to create policies, views or text-widgets can inject scripts to perform administrative actions.
In Samba's WINS server component when running as an Active Directory Domain Controller, protocol handlers for certain request types do not properly validate incoming packets. An unauthenticated remote attacker can send specially crafted UDP packets, triggering a NULL pointer dereference and crashing the WINS service.
In Tenda HG7, HG9, and HG10 devices with firmware 300001138_en_xpon, a stack-based buffer overflow exists in the asp_voip_OtherSet function in /boaform/voip_other_set of the Web Management Interface. Remote manipulation of the funckey_transfer argument triggers the overflow.
Online Music Site 1.0 by code-projects has a SQL Injection vulnerability in /Frontend/Search.php via the Category argument. The attack can be performed remotely, and the exploit is publicly available.
A SQL injection vulnerability was found in code-projects Online Music Site 1.0 in the file /Administrator/PHP/AdminDeleteAlbum.php via manipulation of the ID argument. The attack can be performed remotely and the exploit is public.
A SQL injection vulnerability was found in code-projects Simple Flight Ticket Booking System 1.0 in the file checkUser.php of the POST Parameter Handler component via manipulation of the Username argument. The attack can be performed remotely and the exploit is public.
A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /archive1.php via manipulation of the sy argument. The attack can be performed remotely and the exploit is public.
A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /archive2.php via the sy parameter. The attack can be performed remotely and the exploit has been published.
A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System 1.0 in the file /archive3.php via the sy parameter. The attack can be performed remotely and the exploit is publicly available.
A security flaw was discovered in SourceCodester Class and Exam Timetabling System 1.0 in the file /archive4.php, where manipulation of the sy parameter leads to SQL injection. The attack can be performed remotely and the exploit has been made public.